We have multiple Splunk instances (webui & indexer) that we manage. They're currently kept isolated by design. However, we're trying to figure out the best way to share searches and distribute searches between the instances with minimal effort.
Basically, we want to create a search/report on SplunkB and see it on SplunkA & SplunkC within a short time frame (0-15minutes would suffice). We'd also like the searches from SplunkA to show up on B&C.
Hopefully that makes sense.
↧